Changing Code Privileges Using Impersonation, Elevation, and Delegation

Abstract

Every web part is executed under a given identity. In most cases, this will be the identity of the current logged-on user. But there are times when a web part needs to be able to assume another user context in order to do its work. Normally speaking, changing identities is only a temporary situation. Assuming another user context is widely known as impersonation, although we prefer to use the term impersonation in a narrower sense. We will discern two types of user identity assumption: impersonation and elevation, which differ only in their intent. We talk about impersonation when a process does something on behalf of someone else. A well-known impersonation scenario is when a web part impersonates the identity of an end user to process a request on behalf of the user instead of using the identity of the application pool that runs the web part. A web part elevates when it does something that the current user is not allowed to do. In those types of scenarios, a super account is used to perform the required actions. Elevation is particularly useful for rollup-type web parts: web parts that provide overviews of some sort. You can also discern two types of impersonation based on scope. We call it impersonation when a server process impersonates the client security context on its local system; we call it delegation when the server process impersonates the client security context on a remote system. This chapter shows you all you need to know about doing impersonation, elevation, and delegation within Microsoft Office SharePoint Server 2007.